diffie-hellman: Use bool instead of status_t as get_shared_secret() return value
[strongswan.git] / src / libcharon / sa / ikev2 / tasks / child_create.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Copyright (C) 2005-2008 Martin Willi
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include "child_create.h"
19
20 #include <daemon.h>
21 #include <hydra.h>
22 #include <sa/ikev2/keymat_v2.h>
23 #include <crypto/diffie_hellman.h>
24 #include <credentials/certificates/x509.h>
25 #include <encoding/payloads/sa_payload.h>
26 #include <encoding/payloads/ke_payload.h>
27 #include <encoding/payloads/ts_payload.h>
28 #include <encoding/payloads/nonce_payload.h>
29 #include <encoding/payloads/notify_payload.h>
30 #include <encoding/payloads/delete_payload.h>
31 #include <processing/jobs/delete_ike_sa_job.h>
32 #include <processing/jobs/inactivity_job.h>
33
34
35 typedef struct private_child_create_t private_child_create_t;
36
37 /**
38 * Private members of a child_create_t task.
39 */
40 struct private_child_create_t {
41
42 /**
43 * Public methods and task_t interface.
44 */
45 child_create_t public;
46
47 /**
48 * Assigned IKE_SA.
49 */
50 ike_sa_t *ike_sa;
51
52 /**
53 * Are we the initiator?
54 */
55 bool initiator;
56
57 /**
58 * nonce chosen by us
59 */
60 chunk_t my_nonce;
61
62 /**
63 * nonce chosen by peer
64 */
65 chunk_t other_nonce;
66
67 /**
68 * config to create the CHILD_SA from
69 */
70 child_cfg_t *config;
71
72 /**
73 * list of proposal candidates
74 */
75 linked_list_t *proposals;
76
77 /**
78 * selected proposal to use for CHILD_SA
79 */
80 proposal_t *proposal;
81
82 /**
83 * traffic selectors for initiators side
84 */
85 linked_list_t *tsi;
86
87 /**
88 * traffic selectors for responders side
89 */
90 linked_list_t *tsr;
91
92 /**
93 * source of triggering packet
94 */
95 traffic_selector_t *packet_tsi;
96
97 /**
98 * destination of triggering packet
99 */
100 traffic_selector_t *packet_tsr;
101
102 /**
103 * optional diffie hellman exchange
104 */
105 diffie_hellman_t *dh;
106
107 /**
108 * group used for DH exchange
109 */
110 diffie_hellman_group_t dh_group;
111
112 /**
113 * IKE_SAs keymat
114 */
115 keymat_v2_t *keymat;
116
117 /**
118 * mode the new CHILD_SA uses (transport/tunnel/beet)
119 */
120 ipsec_mode_t mode;
121
122 /**
123 * peer accepts TFC padding for this SA
124 */
125 bool tfcv3;
126
127 /**
128 * IPComp transform to use
129 */
130 ipcomp_transform_t ipcomp;
131
132 /**
133 * IPComp transform proposed or accepted by the other peer
134 */
135 ipcomp_transform_t ipcomp_received;
136
137 /**
138 * Own allocated SPI
139 */
140 u_int32_t my_spi;
141
142 /**
143 * SPI received in proposal
144 */
145 u_int32_t other_spi;
146
147 /**
148 * Own allocated Compression Parameter Index (CPI)
149 */
150 u_int16_t my_cpi;
151
152 /**
153 * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
154 */
155 u_int16_t other_cpi;
156
157 /**
158 * reqid to use if we are rekeying
159 */
160 u_int32_t reqid;
161
162 /**
163 * Explicit inbound mark value
164 */
165 u_int mark_in;
166
167 /**
168 * Explicit outbound mark value
169 */
170 u_int mark_out;
171
172 /**
173 * CHILD_SA which gets established
174 */
175 child_sa_t *child_sa;
176
177 /**
178 * successfully established the CHILD?
179 */
180 bool established;
181
182 /**
183 * whether the CHILD_SA rekeys an existing one
184 */
185 bool rekey;
186
187 /**
188 * whether we are retrying with another DH group
189 */
190 bool retry;
191 };
192
193 /**
194 * get the nonce from a message
195 */
196 static status_t get_nonce(message_t *message, chunk_t *nonce)
197 {
198 nonce_payload_t *payload;
199
200 payload = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
201 if (payload == NULL)
202 {
203 return FAILED;
204 }
205 *nonce = payload->get_nonce(payload);
206 return NEED_MORE;
207 }
208
209 /**
210 * generate a new nonce to include in a CREATE_CHILD_SA message
211 */
212 static status_t generate_nonce(private_child_create_t *this)
213 {
214 nonce_gen_t *nonceg;
215
216 nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
217 if (!nonceg)
218 {
219 DBG1(DBG_IKE, "no nonce generator found to create nonce");
220 return FAILED;
221 }
222 if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, &this->my_nonce))
223 {
224 DBG1(DBG_IKE, "nonce allocation failed");
225 nonceg->destroy(nonceg);
226 return FAILED;
227 }
228 nonceg->destroy(nonceg);
229
230 return SUCCESS;
231 }
232
233 /**
234 * Check a list of traffic selectors if any selector belongs to host
235 */
236 static bool ts_list_is_host(linked_list_t *list, host_t *host)
237 {
238 traffic_selector_t *ts;
239 bool is_host = TRUE;
240 enumerator_t *enumerator = list->create_enumerator(list);
241
242 while (is_host && enumerator->enumerate(enumerator, (void**)&ts))
243 {
244 is_host = is_host && ts->is_host(ts, host);
245 }
246 enumerator->destroy(enumerator);
247 return is_host;
248 }
249
250 /**
251 * Allocate SPIs and update proposals
252 */
253 static bool allocate_spi(private_child_create_t *this)
254 {
255 enumerator_t *enumerator;
256 proposal_t *proposal;
257 protocol_id_t proto = PROTO_ESP;
258
259 if (this->initiator)
260 {
261 /* we just get a SPI for the first protocol. TODO: If we ever support
262 * proposal lists with mixed protocols, we'd need multiple SPIs */
263 if (this->proposals->get_first(this->proposals,
264 (void**)&proposal) == SUCCESS)
265 {
266 proto = proposal->get_protocol(proposal);
267 }
268 }
269 else
270 {
271 proto = this->proposal->get_protocol(this->proposal);
272 }
273 this->my_spi = this->child_sa->alloc_spi(this->child_sa, proto);
274 if (this->my_spi)
275 {
276 if (this->initiator)
277 {
278 enumerator = this->proposals->create_enumerator(this->proposals);
279 while (enumerator->enumerate(enumerator, &proposal))
280 {
281 proposal->set_spi(proposal, this->my_spi);
282 }
283 enumerator->destroy(enumerator);
284 }
285 else
286 {
287 this->proposal->set_spi(this->proposal, this->my_spi);
288 }
289 return TRUE;
290 }
291 return FALSE;
292 }
293
294 /**
295 * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
296 */
297 static void schedule_inactivity_timeout(private_child_create_t *this)
298 {
299 u_int32_t timeout, id;
300 bool close_ike;
301
302 timeout = this->config->get_inactivity(this->config);
303 if (timeout)
304 {
305 close_ike = lib->settings->get_bool(lib->settings,
306 "%s.inactivity_close_ike", FALSE, lib->ns);
307 id = this->child_sa->get_unique_id(this->child_sa);
308 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
309 inactivity_job_create(id, timeout, close_ike), timeout);
310 }
311 }
312
313 /**
314 * Check if we have a an address pool configured
315 */
316 static bool have_pool(ike_sa_t *ike_sa)
317 {
318 enumerator_t *enumerator;
319 peer_cfg_t *peer_cfg;
320 char *pool;
321 bool found = FALSE;
322
323 peer_cfg = ike_sa->get_peer_cfg(ike_sa);
324 if (peer_cfg)
325 {
326 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
327 if (enumerator->enumerate(enumerator, &pool))
328 {
329 found = TRUE;
330 }
331 enumerator->destroy(enumerator);
332 }
333 return found;
334 }
335
336 /**
337 * Get hosts to use for dynamic traffic selectors
338 */
339 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
340 {
341 enumerator_t *enumerator;
342 linked_list_t *list;
343 host_t *host;
344
345 list = linked_list_create();
346 enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
347 while (enumerator->enumerate(enumerator, &host))
348 {
349 list->insert_last(list, host);
350 }
351 enumerator->destroy(enumerator);
352
353 if (list->get_count(list) == 0)
354 { /* no virtual IPs assigned */
355 if (local)
356 {
357 host = ike_sa->get_my_host(ike_sa);
358 list->insert_last(list, host);
359 }
360 else if (!have_pool(ike_sa))
361 { /* use host only if we don't have a pool configured */
362 host = ike_sa->get_other_host(ike_sa);
363 list->insert_last(list, host);
364 }
365 }
366 return list;
367 }
368
369 /**
370 * Substitude any host address with NATed address in traffic selector
371 */
372 static linked_list_t* get_transport_nat_ts(private_child_create_t *this,
373 bool local, linked_list_t *in)
374 {
375 enumerator_t *enumerator;
376 linked_list_t *out;
377 traffic_selector_t *ts;
378 host_t *ike, *first = NULL;
379 u_int8_t mask;
380
381 if (local)
382 {
383 ike = this->ike_sa->get_my_host(this->ike_sa);
384 }
385 else
386 {
387 ike = this->ike_sa->get_other_host(this->ike_sa);
388 }
389
390 out = linked_list_create();
391
392 enumerator = in->create_enumerator(in);
393 while (enumerator->enumerate(enumerator, &ts))
394 {
395 /* require that all selectors match the first "host" selector */
396 if (ts->is_host(ts, first))
397 {
398 if (!first)
399 {
400 ts->to_subnet(ts, &first, &mask);
401 }
402 ts = ts->clone(ts);
403 ts->set_address(ts, ike);
404 out->insert_last(out, ts);
405 }
406 }
407 enumerator->destroy(enumerator);
408 DESTROY_IF(first);
409
410 return out;
411 }
412
413 /**
414 * Narrow received traffic selectors with configuration
415 */
416 static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
417 linked_list_t *in)
418 {
419 linked_list_t *hosts, *nat, *ts;
420 ike_condition_t cond;
421
422 cond = local ? COND_NAT_HERE : COND_NAT_THERE;
423 hosts = get_dynamic_hosts(this->ike_sa, local);
424
425 if (this->mode == MODE_TRANSPORT &&
426 this->ike_sa->has_condition(this->ike_sa, cond))
427 {
428 nat = get_transport_nat_ts(this, local, in);
429 ts = this->config->get_traffic_selectors(this->config, local, nat, hosts);
430 nat->destroy_offset(nat, offsetof(traffic_selector_t, destroy));
431 }
432 else
433 {
434 ts = this->config->get_traffic_selectors(this->config, local, in, hosts);
435 }
436
437 hosts->destroy(hosts);
438
439 return ts;
440 }
441
442 /**
443 * Install a CHILD_SA for usage, return value:
444 * - FAILED: no acceptable proposal
445 * - INVALID_ARG: diffie hellman group inacceptable
446 * - NOT_FOUND: TS inacceptable
447 */
448 static status_t select_and_install(private_child_create_t *this,
449 bool no_dh, bool ike_auth)
450 {
451 status_t status, status_i, status_o;
452 chunk_t nonce_i, nonce_r;
453 chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
454 chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
455 linked_list_t *my_ts, *other_ts;
456 host_t *me, *other;
457 bool private;
458
459 if (this->proposals == NULL)
460 {
461 DBG1(DBG_IKE, "SA payload missing in message");
462 return FAILED;
463 }
464 if (this->tsi == NULL || this->tsr == NULL)
465 {
466 DBG1(DBG_IKE, "TS payloads missing in message");
467 return NOT_FOUND;
468 }
469
470 me = this->ike_sa->get_my_host(this->ike_sa);
471 other = this->ike_sa->get_other_host(this->ike_sa);
472
473 private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
474 this->proposal = this->config->select_proposal(this->config,
475 this->proposals, no_dh, private);
476 if (this->proposal == NULL)
477 {
478 DBG1(DBG_IKE, "no acceptable proposal found");
479 charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD,
480 this->proposals);
481 return FAILED;
482 }
483 this->other_spi = this->proposal->get_spi(this->proposal);
484
485 if (!this->initiator && !allocate_spi(this))
486 { /* responder has no SPI allocated yet */
487 DBG1(DBG_IKE, "allocating SPI failed");
488 return FAILED;
489 }
490 this->child_sa->set_proposal(this->child_sa, this->proposal);
491
492 if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
493 {
494 u_int16_t group;
495
496 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
497 &group, NULL))
498 {
499 DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
500 diffie_hellman_group_names, this->dh_group,
501 diffie_hellman_group_names, group);
502 this->dh_group = group;
503 return INVALID_ARG;
504 }
505 /* the selected proposal does not use a DH group */
506 DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
507 DESTROY_IF(this->dh);
508 this->dh = NULL;
509 this->dh_group = MODP_NONE;
510 }
511
512 if (this->initiator)
513 {
514 nonce_i = this->my_nonce;
515 nonce_r = this->other_nonce;
516 my_ts = narrow_ts(this, TRUE, this->tsi);
517 other_ts = narrow_ts(this, FALSE, this->tsr);
518 }
519 else
520 {
521 nonce_r = this->my_nonce;
522 nonce_i = this->other_nonce;
523 my_ts = narrow_ts(this, TRUE, this->tsr);
524 other_ts = narrow_ts(this, FALSE, this->tsi);
525 }
526
527 if (this->initiator)
528 {
529 if (ike_auth)
530 {
531 charon->bus->narrow(charon->bus, this->child_sa,
532 NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
533 }
534 else
535 {
536 charon->bus->narrow(charon->bus, this->child_sa,
537 NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
538 }
539 }
540 else
541 {
542 charon->bus->narrow(charon->bus, this->child_sa,
543 NARROW_RESPONDER, my_ts, other_ts);
544 }
545
546 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
547 {
548 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
549 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
550 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
551 DBG1(DBG_IKE, "no acceptable traffic selectors found");
552 return NOT_FOUND;
553 }
554
555 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
556 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
557 if (this->initiator)
558 {
559 this->tsi = my_ts;
560 this->tsr = other_ts;
561 }
562 else
563 {
564 this->tsr = my_ts;
565 this->tsi = other_ts;
566 }
567
568 if (!this->initiator)
569 {
570 /* check if requested mode is acceptable, downgrade if required */
571 switch (this->mode)
572 {
573 case MODE_TRANSPORT:
574 if (!this->config->use_proxy_mode(this->config) &&
575 (!ts_list_is_host(this->tsi, other) ||
576 !ts_list_is_host(this->tsr, me))
577 )
578 {
579 this->mode = MODE_TUNNEL;
580 DBG1(DBG_IKE, "not using transport mode, not host-to-host");
581 }
582 if (this->config->get_mode(this->config) != MODE_TRANSPORT)
583 {
584 this->mode = MODE_TUNNEL;
585 }
586 break;
587 case MODE_BEET:
588 if (!ts_list_is_host(this->tsi, NULL) ||
589 !ts_list_is_host(this->tsr, NULL))
590 {
591 this->mode = MODE_TUNNEL;
592 DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
593 }
594 if (this->config->get_mode(this->config) != MODE_BEET)
595 {
596 this->mode = MODE_TUNNEL;
597 }
598 break;
599 default:
600 break;
601 }
602 }
603
604 this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
605 this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
606 this->child_sa->set_mode(this->child_sa, this->mode);
607 this->child_sa->set_protocol(this->child_sa,
608 this->proposal->get_protocol(this->proposal));
609
610 if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
611 {
612 this->my_cpi = this->other_cpi = 0;
613 this->ipcomp = IPCOMP_NONE;
614 }
615 status_i = status_o = FAILED;
616 if (this->keymat->derive_child_keys(this->keymat, this->proposal,
617 this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
618 {
619 if (this->initiator)
620 {
621 status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
622 this->my_spi, this->my_cpi, this->initiator,
623 TRUE, this->tfcv3, my_ts, other_ts);
624 status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
625 this->other_spi, this->other_cpi, this->initiator,
626 FALSE, this->tfcv3, my_ts, other_ts);
627 }
628 else
629 {
630 status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
631 this->my_spi, this->my_cpi, this->initiator,
632 TRUE, this->tfcv3, my_ts, other_ts);
633 status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
634 this->other_spi, this->other_cpi, this->initiator,
635 FALSE, this->tfcv3, my_ts, other_ts);
636 }
637 }
638 chunk_clear(&integ_i);
639 chunk_clear(&integ_r);
640 chunk_clear(&encr_i);
641 chunk_clear(&encr_r);
642
643 if (status_i != SUCCESS || status_o != SUCCESS)
644 {
645 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
646 (status_i != SUCCESS) ? "inbound " : "",
647 (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
648 (status_o != SUCCESS) ? "outbound " : "");
649 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
650 this->child_sa);
651 return FAILED;
652 }
653
654 if (this->initiator)
655 {
656 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
657 }
658 else
659 {
660 /* use a copy of the traffic selectors, as the POST hook should not
661 * change payloads */
662 my_ts = this->tsr->clone_offset(this->tsr,
663 offsetof(traffic_selector_t, clone));
664 other_ts = this->tsi->clone_offset(this->tsi,
665 offsetof(traffic_selector_t, clone));
666 charon->bus->narrow(charon->bus, this->child_sa,
667 NARROW_RESPONDER_POST, my_ts, other_ts);
668 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
669 {
670 status = FAILED;
671 }
672 else
673 {
674 status = this->child_sa->add_policies(this->child_sa,
675 my_ts, other_ts);
676 }
677 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
678 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
679 }
680 if (status != SUCCESS)
681 {
682 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
683 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED,
684 this->child_sa);
685 return NOT_FOUND;
686 }
687
688 charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
689 this->dh, nonce_i, nonce_r);
690
691 /* add to IKE_SA, and remove from task */
692 this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
693 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
694 this->established = TRUE;
695
696 schedule_inactivity_timeout(this);
697
698 my_ts = linked_list_create_from_enumerator(
699 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
700 other_ts = linked_list_create_from_enumerator(
701 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
702
703 DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
704 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
705 this->child_sa->get_name(this->child_sa),
706 this->child_sa->get_unique_id(this->child_sa),
707 ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
708 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
709
710 my_ts->destroy(my_ts);
711 other_ts->destroy(other_ts);
712
713 return SUCCESS;
714 }
715
716 /**
717 * build the payloads for the message
718 */
719 static void build_payloads(private_child_create_t *this, message_t *message)
720 {
721 sa_payload_t *sa_payload;
722 nonce_payload_t *nonce_payload;
723 ke_payload_t *ke_payload;
724 ts_payload_t *ts_payload;
725 kernel_feature_t features;
726
727 /* add SA payload */
728 if (this->initiator)
729 {
730 sa_payload = sa_payload_create_from_proposals_v2(this->proposals);
731 }
732 else
733 {
734 sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
735 }
736 message->add_payload(message, (payload_t*)sa_payload);
737
738 /* add nonce payload if not in IKE_AUTH */
739 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
740 {
741 nonce_payload = nonce_payload_create(PLV2_NONCE);
742 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
743 message->add_payload(message, (payload_t*)nonce_payload);
744 }
745
746 /* diffie hellman exchange, if PFS enabled */
747 if (this->dh)
748 {
749 ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
750 this->dh);
751 message->add_payload(message, (payload_t*)ke_payload);
752 }
753
754 /* add TSi/TSr payloads */
755 ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
756 message->add_payload(message, (payload_t*)ts_payload);
757 ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
758 message->add_payload(message, (payload_t*)ts_payload);
759
760 /* add a notify if we are not in tunnel mode */
761 switch (this->mode)
762 {
763 case MODE_TRANSPORT:
764 message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
765 break;
766 case MODE_BEET:
767 message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
768 break;
769 default:
770 break;
771 }
772
773 features = hydra->kernel_interface->get_features(hydra->kernel_interface);
774 if (!(features & KERNEL_ESP_V3_TFC))
775 {
776 message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED,
777 chunk_empty);
778 }
779 }
780
781 /**
782 * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
783 */
784 static void add_ipcomp_notify(private_child_create_t *this,
785 message_t *message, u_int8_t ipcomp)
786 {
787 this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
788 if (this->my_cpi)
789 {
790 this->ipcomp = ipcomp;
791 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
792 chunk_cata("cc", chunk_from_thing(this->my_cpi),
793 chunk_from_thing(ipcomp)));
794 }
795 else
796 {
797 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
798 }
799 }
800
801 /**
802 * handle a received notify payload
803 */
804 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
805 {
806 switch (notify->get_notify_type(notify))
807 {
808 case USE_TRANSPORT_MODE:
809 this->mode = MODE_TRANSPORT;
810 break;
811 case USE_BEET_MODE:
812 if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
813 { /* handle private use notify only if we know its meaning */
814 this->mode = MODE_BEET;
815 }
816 else
817 {
818 DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
819 "mode, but peer implementation unknown, skipped");
820 }
821 break;
822 case IPCOMP_SUPPORTED:
823 {
824 ipcomp_transform_t ipcomp;
825 u_int16_t cpi;
826 chunk_t data;
827
828 data = notify->get_notification_data(notify);
829 cpi = *(u_int16_t*)data.ptr;
830 ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
831 switch (ipcomp)
832 {
833 case IPCOMP_DEFLATE:
834 this->other_cpi = cpi;
835 this->ipcomp_received = ipcomp;
836 break;
837 case IPCOMP_LZS:
838 case IPCOMP_LZJH:
839 default:
840 DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
841 "transform ID we don't support %N",
842 ipcomp_transform_names, ipcomp);
843 break;
844 }
845 break;
846 }
847 case ESP_TFC_PADDING_NOT_SUPPORTED:
848 DBG1(DBG_IKE, "received %N, not using ESPv3 TFC padding",
849 notify_type_names, notify->get_notify_type(notify));
850 this->tfcv3 = FALSE;
851 break;
852 default:
853 break;
854 }
855 }
856
857 /**
858 * Read payloads from message
859 */
860 static void process_payloads(private_child_create_t *this, message_t *message)
861 {
862 enumerator_t *enumerator;
863 payload_t *payload;
864 sa_payload_t *sa_payload;
865 ke_payload_t *ke_payload;
866 ts_payload_t *ts_payload;
867
868 /* defaults to TUNNEL mode */
869 this->mode = MODE_TUNNEL;
870
871 enumerator = message->create_payload_enumerator(message);
872 while (enumerator->enumerate(enumerator, &payload))
873 {
874 switch (payload->get_type(payload))
875 {
876 case PLV2_SECURITY_ASSOCIATION:
877 sa_payload = (sa_payload_t*)payload;
878 this->proposals = sa_payload->get_proposals(sa_payload);
879 break;
880 case PLV2_KEY_EXCHANGE:
881 ke_payload = (ke_payload_t*)payload;
882 if (!this->initiator)
883 {
884 this->dh_group = ke_payload->get_dh_group_number(ke_payload);
885 this->dh = this->keymat->keymat.create_dh(
886 &this->keymat->keymat, this->dh_group);
887 }
888 if (this->dh)
889 {
890 this->dh->set_other_public_value(this->dh,
891 ke_payload->get_key_exchange_data(ke_payload));
892 }
893 break;
894 case PLV2_TS_INITIATOR:
895 ts_payload = (ts_payload_t*)payload;
896 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
897 break;
898 case PLV2_TS_RESPONDER:
899 ts_payload = (ts_payload_t*)payload;
900 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
901 break;
902 case PLV2_NOTIFY:
903 handle_notify(this, (notify_payload_t*)payload);
904 break;
905 default:
906 break;
907 }
908 }
909 enumerator->destroy(enumerator);
910 }
911
912 METHOD(task_t, build_i, status_t,
913 private_child_create_t *this, message_t *message)
914 {
915 enumerator_t *enumerator;
916 host_t *vip;
917 peer_cfg_t *peer_cfg;
918 linked_list_t *list;
919
920 switch (message->get_exchange_type(message))
921 {
922 case IKE_SA_INIT:
923 return get_nonce(message, &this->my_nonce);
924 case CREATE_CHILD_SA:
925 if (generate_nonce(this) != SUCCESS)
926 {
927 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
928 return SUCCESS;
929 }
930 if (!this->retry)
931 {
932 this->dh_group = this->config->get_dh_group(this->config);
933 }
934 break;
935 case IKE_AUTH:
936 if (message->get_message_id(message) != 1)
937 {
938 /* send only in the first request, not in subsequent rounds */
939 return NEED_MORE;
940 }
941 break;
942 default:
943 break;
944 }
945
946 if (this->reqid)
947 {
948 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
949 this->config->get_name(this->config), this->reqid);
950 }
951 else
952 {
953 DBG0(DBG_IKE, "establishing CHILD_SA %s",
954 this->config->get_name(this->config));
955 }
956
957 /* check if we want a virtual IP, but don't have one */
958 list = linked_list_create();
959 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
960 if (!this->rekey)
961 {
962 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
963 while (enumerator->enumerate(enumerator, &vip))
964 {
965 /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
966 vip = host_create_any(vip->get_family(vip));
967 list->insert_last(list, vip);
968 }
969 enumerator->destroy(enumerator);
970 }
971 if (list->get_count(list))
972 {
973 this->tsi = this->config->get_traffic_selectors(this->config,
974 TRUE, NULL, list);
975 list->destroy_offset(list, offsetof(host_t, destroy));
976 }
977 else
978 { /* no virtual IPs configured */
979 list->destroy(list);
980 list = get_dynamic_hosts(this->ike_sa, TRUE);
981 this->tsi = this->config->get_traffic_selectors(this->config,
982 TRUE, NULL, list);
983 list->destroy(list);
984 }
985 list = get_dynamic_hosts(this->ike_sa, FALSE);
986 this->tsr = this->config->get_traffic_selectors(this->config,
987 FALSE, NULL, list);
988 list->destroy(list);
989
990 if (this->packet_tsi)
991 {
992 this->tsi->insert_first(this->tsi,
993 this->packet_tsi->clone(this->packet_tsi));
994 }
995 if (this->packet_tsr)
996 {
997 this->tsr->insert_first(this->tsr,
998 this->packet_tsr->clone(this->packet_tsr));
999 }
1000 this->proposals = this->config->get_proposals(this->config,
1001 this->dh_group == MODP_NONE);
1002 this->mode = this->config->get_mode(this->config);
1003
1004 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1005 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1006 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1007 this->mark_in, this->mark_out);
1008
1009 if (!allocate_spi(this))
1010 {
1011 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
1012 return FAILED;
1013 }
1014
1015 if (this->dh_group != MODP_NONE)
1016 {
1017 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1018 this->dh_group);
1019 }
1020
1021 if (this->config->use_ipcomp(this->config))
1022 {
1023 /* IPCOMP_DEFLATE is the only transform we support at the moment */
1024 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
1025 }
1026
1027 if (message->get_exchange_type(message) == IKE_AUTH)
1028 {
1029 charon->bus->narrow(charon->bus, this->child_sa,
1030 NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
1031 }
1032 else
1033 {
1034 charon->bus->narrow(charon->bus, this->child_sa,
1035 NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
1036 }
1037
1038 build_payloads(this, message);
1039
1040 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1041 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1042 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1043 this->tsi = NULL;
1044 this->tsr = NULL;
1045 this->proposals = NULL;
1046
1047 return NEED_MORE;
1048 }
1049
1050 METHOD(task_t, process_r, status_t,
1051 private_child_create_t *this, message_t *message)
1052 {
1053 switch (message->get_exchange_type(message))
1054 {
1055 case IKE_SA_INIT:
1056 return get_nonce(message, &this->other_nonce);
1057 case CREATE_CHILD_SA:
1058 get_nonce(message, &this->other_nonce);
1059 break;
1060 case IKE_AUTH:
1061 if (message->get_message_id(message) != 1)
1062 {
1063 /* only handle first AUTH payload, not additional rounds */
1064 return NEED_MORE;
1065 }
1066 default:
1067 break;
1068 }
1069
1070 process_payloads(this, message);
1071
1072 return NEED_MORE;
1073 }
1074
1075 /**
1076 * handle CHILD_SA setup failure
1077 */
1078 static void handle_child_sa_failure(private_child_create_t *this,
1079 message_t *message)
1080 {
1081 if (message->get_exchange_type(message) == IKE_AUTH &&
1082 lib->settings->get_bool(lib->settings,
1083 "%s.close_ike_on_child_failure", FALSE, lib->ns))
1084 {
1085 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
1086 * first */
1087 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
1088 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
1089 delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
1090 100);
1091 }
1092 else
1093 {
1094 DBG1(DBG_IKE, "failed to establish CHILD_SA, keeping IKE_SA");
1095 charon->bus->alert(charon->bus, ALERT_KEEP_ON_CHILD_SA_FAILURE);
1096 }
1097 }
1098
1099 /**
1100 * Substitute transport mode NAT selectors, if applicable
1101 */
1102 static linked_list_t* get_ts_if_nat_transport(private_child_create_t *this,
1103 bool local, linked_list_t *in)
1104 {
1105 linked_list_t *out = NULL;
1106 ike_condition_t cond;
1107
1108 if (this->mode == MODE_TRANSPORT)
1109 {
1110 cond = local ? COND_NAT_HERE : COND_NAT_THERE;
1111 if (this->ike_sa->has_condition(this->ike_sa, cond))
1112 {
1113 out = get_transport_nat_ts(this, local, in);
1114 if (out->get_count(out) == 0)
1115 {
1116 out->destroy(out);
1117 out = NULL;
1118 }
1119 }
1120 }
1121 return out;
1122 }
1123
1124 /**
1125 * Select a matching CHILD config as responder
1126 */
1127 static child_cfg_t* select_child_cfg(private_child_create_t *this)
1128 {
1129 peer_cfg_t *peer_cfg;
1130 child_cfg_t *child_cfg = NULL;;
1131
1132 peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1133 if (peer_cfg && this->tsi && this->tsr)
1134 {
1135 linked_list_t *listr, *listi, *tsr, *tsi;
1136
1137 tsr = get_ts_if_nat_transport(this, TRUE, this->tsr);
1138 tsi = get_ts_if_nat_transport(this, FALSE, this->tsi);
1139
1140 listr = get_dynamic_hosts(this->ike_sa, TRUE);
1141 listi = get_dynamic_hosts(this->ike_sa, FALSE);
1142 child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1143 tsr ?: this->tsr, tsi ?: this->tsi,
1144 listr, listi);
1145 if ((tsi || tsr) && child_cfg &&
1146 child_cfg->get_mode(child_cfg) != MODE_TRANSPORT)
1147 {
1148 /* found a CHILD config, but it doesn't use transport mode */
1149 child_cfg->destroy(child_cfg);
1150 child_cfg = NULL;
1151 }
1152 if (!child_cfg && (tsi || tsr))
1153 {
1154 /* no match for the substituted NAT selectors, try it without */
1155 child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1156 this->tsr, this->tsi, listr, listi);
1157 }
1158 listr->destroy(listr);
1159 listi->destroy(listi);
1160 DESTROY_OFFSET_IF(tsi, offsetof(traffic_selector_t, destroy));
1161 DESTROY_OFFSET_IF(tsr, offsetof(traffic_selector_t, destroy));
1162 }
1163
1164 return child_cfg;
1165 }
1166
1167 METHOD(task_t, build_r, status_t,
1168 private_child_create_t *this, message_t *message)
1169 {
1170 payload_t *payload;
1171 enumerator_t *enumerator;
1172 bool no_dh = TRUE, ike_auth = FALSE;
1173
1174 switch (message->get_exchange_type(message))
1175 {
1176 case IKE_SA_INIT:
1177 return get_nonce(message, &this->my_nonce);
1178 case CREATE_CHILD_SA:
1179 if (generate_nonce(this) != SUCCESS)
1180 {
1181 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1182 chunk_empty);
1183 return SUCCESS;
1184 }
1185 no_dh = FALSE;
1186 break;
1187 case IKE_AUTH:
1188 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1189 { /* wait until all authentication round completed */
1190 return NEED_MORE;
1191 }
1192 ike_auth = TRUE;
1193 default:
1194 break;
1195 }
1196
1197 if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
1198 {
1199 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
1200 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1201 return SUCCESS;
1202 }
1203 if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
1204 {
1205 DBG1(DBG_IKE, "unable to create CHILD_SA while deleting IKE_SA");
1206 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1207 return SUCCESS;
1208 }
1209
1210 if (this->config == NULL)
1211 {
1212 this->config = select_child_cfg(this);
1213 }
1214 if (this->config == NULL)
1215 {
1216 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
1217 this->tsr, this->tsi);
1218 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
1219 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1220 handle_child_sa_failure(this, message);
1221 return SUCCESS;
1222 }
1223
1224 /* check if ike_config_t included non-critical error notifies */
1225 enumerator = message->create_payload_enumerator(message);
1226 while (enumerator->enumerate(enumerator, &payload))
1227 {
1228 if (payload->get_type(payload) == PLV2_NOTIFY)
1229 {
1230 notify_payload_t *notify = (notify_payload_t*)payload;
1231
1232 switch (notify->get_notify_type(notify))
1233 {
1234 case INTERNAL_ADDRESS_FAILURE:
1235 case FAILED_CP_REQUIRED:
1236 {
1237 DBG1(DBG_IKE,"configuration payload negotiation "
1238 "failed, no CHILD_SA built");
1239 enumerator->destroy(enumerator);
1240 handle_child_sa_failure(this, message);
1241 return SUCCESS;
1242 }
1243 default:
1244 break;
1245 }
1246 }
1247 }
1248 enumerator->destroy(enumerator);
1249
1250 this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1251 this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1252 this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1253 this->mark_in, this->mark_out);
1254
1255 if (this->ipcomp_received != IPCOMP_NONE)
1256 {
1257 if (this->config->use_ipcomp(this->config))
1258 {
1259 add_ipcomp_notify(this, message, this->ipcomp_received);
1260 }
1261 else
1262 {
1263 DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
1264 notify_type_names, IPCOMP_SUPPORTED);
1265 }
1266 }
1267
1268 switch (select_and_install(this, no_dh, ike_auth))
1269 {
1270 case SUCCESS:
1271 break;
1272 case NOT_FOUND:
1273 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1274 handle_child_sa_failure(this, message);
1275 return SUCCESS;
1276 case INVALID_ARG:
1277 {
1278 u_int16_t group = htons(this->dh_group);
1279 message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1280 chunk_from_thing(group));
1281 handle_child_sa_failure(this, message);
1282 return SUCCESS;
1283 }
1284 case FAILED:
1285 default:
1286 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1287 handle_child_sa_failure(this, message);
1288 return SUCCESS;
1289 }
1290
1291 build_payloads(this, message);
1292
1293 if (!this->rekey)
1294 { /* invoke the child_up() hook if we are not rekeying */
1295 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1296 }
1297 return SUCCESS;
1298 }
1299
1300 /**
1301 * Raise alerts for received notify errors
1302 */
1303 static void raise_alerts(private_child_create_t *this, notify_type_t type)
1304 {
1305 linked_list_t *list;
1306
1307 switch (type)
1308 {
1309 case NO_PROPOSAL_CHOSEN:
1310 list = this->config->get_proposals(this->config, FALSE);
1311 charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD, list);
1312 list->destroy_offset(list, offsetof(proposal_t, destroy));
1313 break;
1314 default:
1315 break;
1316 }
1317 }
1318
1319 METHOD(task_t, build_i_delete, status_t,
1320 private_child_create_t *this, message_t *message)
1321 {
1322 message->set_exchange_type(message, INFORMATIONAL);
1323 if (this->child_sa && this->proposal)
1324 {
1325 protocol_id_t proto;
1326 delete_payload_t *del;
1327 u_int32_t spi;
1328
1329 proto = this->proposal->get_protocol(this->proposal);
1330 spi = this->child_sa->get_spi(this->child_sa, TRUE);
1331 del = delete_payload_create(PLV2_DELETE, proto);
1332 del->add_spi(del, spi);
1333 message->add_payload(message, (payload_t*)del);
1334
1335 DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
1336 protocol_id_names, proto, ntohl(spi));
1337 }
1338 return NEED_MORE;
1339 }
1340
1341 /**
1342 * Change task to delete the failed CHILD_SA as initiator
1343 */
1344 static status_t delete_failed_sa(private_child_create_t *this)
1345 {
1346 this->public.task.build = _build_i_delete;
1347 this->public.task.process = (void*)return_success;
1348 return NEED_MORE;
1349 }
1350
1351 METHOD(task_t, process_i, status_t,
1352 private_child_create_t *this, message_t *message)
1353 {
1354 enumerator_t *enumerator;
1355 payload_t *payload;
1356 bool no_dh = TRUE, ike_auth = FALSE;
1357
1358 switch (message->get_exchange_type(message))
1359 {
1360 case IKE_SA_INIT:
1361 return get_nonce(message, &this->other_nonce);
1362 case CREATE_CHILD_SA:
1363 get_nonce(message, &this->other_nonce);
1364 no_dh = FALSE;
1365 break;
1366 case IKE_AUTH:
1367 if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1368 { /* wait until all authentication round completed */
1369 return NEED_MORE;
1370 }
1371 ike_auth = TRUE;
1372 default:
1373 break;
1374 }
1375
1376 /* check for erroneous notifies */
1377 enumerator = message->create_payload_enumerator(message);
1378 while (enumerator->enumerate(enumerator, &payload))
1379 {
1380 if (payload->get_type(payload) == PLV2_NOTIFY)
1381 {
1382 notify_payload_t *notify = (notify_payload_t*)payload;
1383 notify_type_t type = notify->get_notify_type(notify);
1384
1385 switch (type)
1386 {
1387 /* handle notify errors related to CHILD_SA only */
1388 case NO_PROPOSAL_CHOSEN:
1389 case SINGLE_PAIR_REQUIRED:
1390 case NO_ADDITIONAL_SAS:
1391 case INTERNAL_ADDRESS_FAILURE:
1392 case FAILED_CP_REQUIRED:
1393 case TS_UNACCEPTABLE:
1394 case INVALID_SELECTORS:
1395 {
1396 DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1397 notify_type_names, type);
1398 enumerator->destroy(enumerator);
1399 raise_alerts(this, type);
1400 handle_child_sa_failure(this, message);
1401 /* an error in CHILD_SA creation is not critical */
1402 return SUCCESS;
1403 }
1404 case INVALID_KE_PAYLOAD:
1405 {
1406 chunk_t data;
1407 u_int16_t group = MODP_NONE;
1408
1409 data = notify->get_notification_data(notify);
1410 if (data.len == sizeof(group))
1411 {
1412 memcpy(&group, data.ptr, data.len);
1413 group = ntohs(group);
1414 }
1415 DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1416 "it requested %N", diffie_hellman_group_names,
1417 this->dh_group, diffie_hellman_group_names, group);
1418 this->retry = TRUE;
1419 this->dh_group = group;
1420 this->child_sa->set_state(this->child_sa, CHILD_RETRYING);
1421 this->public.task.migrate(&this->public.task, this->ike_sa);
1422 enumerator->destroy(enumerator);
1423 return NEED_MORE;
1424 }
1425 default:
1426 {
1427 if (message->get_exchange_type(message) == CREATE_CHILD_SA)
1428 { /* handle notifies if not handled in IKE_AUTH */
1429 if (type <= 16383)
1430 {
1431 DBG1(DBG_IKE, "received %N notify error",
1432 notify_type_names, type);
1433 enumerator->destroy(enumerator);
1434 return SUCCESS;
1435 }
1436 DBG2(DBG_IKE, "received %N notify",
1437 notify_type_names, type);
1438 }
1439 break;
1440 }
1441 }
1442 }
1443 }
1444 enumerator->destroy(enumerator);
1445
1446 process_payloads(this, message);
1447
1448 if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1449 {
1450 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1451 " one, no CHILD_SA built");
1452 handle_child_sa_failure(this, message);
1453 return delete_failed_sa(this);
1454 }
1455 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1456 {
1457 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1458 "IPComp is disabled");
1459 this->ipcomp = IPCOMP_NONE;
1460 }
1461 else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1462 {
1463 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1464 "no CHILD_SA built");
1465 handle_child_sa_failure(this, message);
1466 return delete_failed_sa(this);
1467 }
1468
1469 if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1470 {
1471 if (!this->rekey)
1472 { /* invoke the child_up() hook if we are not rekeying */
1473 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1474 }
1475 }
1476 else
1477 {
1478 handle_child_sa_failure(this, message);
1479 return delete_failed_sa(this);
1480 }
1481 return SUCCESS;
1482 }
1483
1484 METHOD(child_create_t, use_reqid, void,
1485 private_child_create_t *this, u_int32_t reqid)
1486 {
1487 this->reqid = reqid;
1488 }
1489
1490 METHOD(child_create_t, use_marks, void,
1491 private_child_create_t *this, u_int in, u_int out)
1492 {
1493 this->mark_in = in;
1494 this->mark_out = out;
1495 }
1496
1497 METHOD(child_create_t, get_child, child_sa_t*,
1498 private_child_create_t *this)
1499 {
1500 return this->child_sa;
1501 }
1502
1503 METHOD(child_create_t, set_config, void,
1504 private_child_create_t *this, child_cfg_t *cfg)
1505 {
1506 DESTROY_IF(this->config);
1507 this->config = cfg;
1508 }
1509
1510 METHOD(child_create_t, get_lower_nonce, chunk_t,
1511 private_child_create_t *this)
1512 {
1513 if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1514 min(this->my_nonce.len, this->other_nonce.len)) < 0)
1515 {
1516 return this->my_nonce;
1517 }
1518 else
1519 {
1520 return this->other_nonce;
1521 }
1522 }
1523
1524 METHOD(task_t, get_type, task_type_t,
1525 private_child_create_t *this)
1526 {
1527 return TASK_CHILD_CREATE;
1528 }
1529
1530 METHOD(task_t, migrate, void,
1531 private_child_create_t *this, ike_sa_t *ike_sa)
1532 {
1533 chunk_free(&this->my_nonce);
1534 chunk_free(&this->other_nonce);
1535 if (this->tsr)
1536 {
1537 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1538 }
1539 if (this->tsi)
1540 {
1541 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1542 }
1543 DESTROY_IF(this->child_sa);
1544 DESTROY_IF(this->proposal);
1545 DESTROY_IF(this->dh);
1546 if (this->proposals)
1547 {
1548 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1549 }
1550
1551 this->ike_sa = ike_sa;
1552 this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
1553 this->proposal = NULL;
1554 this->proposals = NULL;
1555 this->tsi = NULL;
1556 this->tsr = NULL;
1557 this->dh = NULL;
1558 this->child_sa = NULL;
1559 this->mode = MODE_TUNNEL;
1560 this->ipcomp = IPCOMP_NONE;
1561 this->ipcomp_received = IPCOMP_NONE;
1562 this->other_cpi = 0;
1563 this->reqid = 0;
1564 this->mark_in = 0;
1565 this->mark_out = 0;
1566 this->established = FALSE;
1567 }
1568
1569 METHOD(task_t, destroy, void,
1570 private_child_create_t *this)
1571 {
1572 chunk_free(&this->my_nonce);
1573 chunk_free(&this->other_nonce);
1574 if (this->tsr)
1575 {
1576 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1577 }
1578 if (this->tsi)
1579 {
1580 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1581 }
1582 if (!this->established)
1583 {
1584 DESTROY_IF(this->child_sa);
1585 }
1586 DESTROY_IF(this->packet_tsi);
1587 DESTROY_IF(this->packet_tsr);
1588 DESTROY_IF(this->proposal);
1589 DESTROY_IF(this->dh);
1590 if (this->proposals)
1591 {
1592 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1593 }
1594
1595 DESTROY_IF(this->config);
1596 free(this);
1597 }
1598
1599 /*
1600 * Described in header.
1601 */
1602 child_create_t *child_create_create(ike_sa_t *ike_sa,
1603 child_cfg_t *config, bool rekey,
1604 traffic_selector_t *tsi, traffic_selector_t *tsr)
1605 {
1606 private_child_create_t *this;
1607
1608 INIT(this,
1609 .public = {
1610 .get_child = _get_child,
1611 .set_config = _set_config,
1612 .get_lower_nonce = _get_lower_nonce,
1613 .use_reqid = _use_reqid,
1614 .use_marks = _use_marks,
1615 .task = {
1616 .get_type = _get_type,
1617 .migrate = _migrate,
1618 .destroy = _destroy,
1619 },
1620 },
1621 .ike_sa = ike_sa,
1622 .config = config,
1623 .packet_tsi = tsi ? tsi->clone(tsi) : NULL,
1624 .packet_tsr = tsr ? tsr->clone(tsr) : NULL,
1625 .dh_group = MODP_NONE,
1626 .keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
1627 .mode = MODE_TUNNEL,
1628 .tfcv3 = TRUE,
1629 .ipcomp = IPCOMP_NONE,
1630 .ipcomp_received = IPCOMP_NONE,
1631 .rekey = rekey,
1632 .retry = FALSE,
1633 );
1634
1635 if (config)
1636 {
1637 this->public.task.build = _build_i;
1638 this->public.task.process = _process_i;
1639 this->initiator = TRUE;
1640 }
1641 else
1642 {
1643 this->public.task.build = _build_r;
1644 this->public.task.process = _process_r;
1645 this->initiator = FALSE;
1646 }
1647
1648 return &this->public;
1649 }